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1 METHOD AND SYSTEM FOR MASS DISTRIBUTION OF 

2 GEOGRAPHIC DATA FOR NAVIGATION SYSTEMS 

3 INCORPORATION BY REFERENCE 

4 This specification is filed contemporaneously with two other U.S. patent applications, 

5 entitled respectively "Encryption Method for Distribution of Data" and "Navigation System with 

6 Decryption Functions and Secure Geographic Database," each by the same inventor as the present 

7 invention, and each assigned to the owner of the present invention. The entirety of each of these 

8 other applications is hereby incorporated by reference. 

9 This specification is also related to the subject matter of U.S. Patent No. 5,95 1 ,620 (the 

10 '620 patent), which is entitled "System and Method for Distributing Information for Storage 

11 Media," and which issued on September 14, 1999 to Navigation Technologies Corporation of 

12 Rosemont, Illinois. The entirety of the '620 patent is also hereby incorporated by reference. 
13 

14 BACKGROUND OF THE INVENTION 

15 1 . Field of the Invention 

The present invention relates to a system and method for secure distribution of digital 
data to end users' media for use by the end users. More particularly, the present invention relates 
to systems and methods for distributing geographic data to end users for use in their navigation 

19 systems. 

20 2. Description of Related Art 

21 There are various different types of devices for which end users are required to obtain 

22 digital data. One type of device for which end users are required to obtain digital data is a 

23 navigation system. Navigation systems for use on land have become available in a variety of 
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1 forms and provide for a variety of useful features. One exemplary type of navigation system 

2 uses (1) a geographic database that contains data representing features in a geographic area or 

3 region, (2) a navigation application program, (3) appropriate computer hardware, such as a 

4 microprocessor and memory, and, optionally, (4) a positioning system. The geographic database 

5 portion of the navigation system includes information about the positions of roads and 

6 intersections in or related to a specific geographic regional area, and may also include 

7 information about attributes, such as one-way streets and turn restrictions, as well as about street 

8 addresses, alternative routes, hotels, restaurants, museums, stadiums, offices, automobile 

9 dealerships, auto repair shops, etc. 

^1 0 The positioning system may employ any of several well-known technologies to 

0=1 1 determine or approximate one's physical location in a geographic regional area. For example, the 

il2 positioning system may employ a GPS-type system (global positioning system), a "dead 
reckoning"-type system, or combinations of these, or other systems, all of which are well-known 

~34 in the art. 

jEl5 The navigation application program portion of the navigation system is typically a 

pi6 software program that uses data from the geographic database and the positioning system (when 

17 employed). The navigation application program may provide the user with a graphical display 

18 (e.g. a "map") of his specific location in the geographic area. In addition, the navigation 

19 application program may also provide the user with specific directions to locations in the 

20 geographic area from wherever he is located. 

21 The geographic data used by a navigation system may be stored locally with the 

22 navigation system in the vehicle, or, alternatively, the geographic data may be located remotely 

23 and downloaded to the navigation application programs, as needed, via a wireless 
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communications system or other suitable communications channel. An advantage associated 
with having the geographic data stored locally with the navigation system is that a large amount 
of data is continuously available to the navigation system, thereby avoiding the costs associated 

4 with installing and maintaining a communications infrastructure that affords the necessary 

5 bandwidth needed to provide the data from a remote site. On the other hand, a consideration 

6 associated with storing geographic data locally with the navigation system is the need to update 

7 the data on a regular basis. 

8 Accordingly, there is a need for a system and method for the distribution of new and 

9 updated geographic data to users of navigation systems. 

So Another consideration associated with providing geographic data for navigation systems 

is the need to safeguard the data from unlicensed uses, e.g., illegal copying. The collection of 
geographic data can be a relatively time-consuming and expensive process. Therefore, although 
it is desirable to make it easy for users of navigation systems to obtain new and updated 
j 14 geographic data, it is also desired to provide security measures that prevent unlicensed uses. 
J 15 As mentioned above, there are various different types of devices for which end users are 

required to obtain digital data. Other devices include music players (e.g., audio CD players, 
17 MP3 players, as well as players that support other formats), video game consoles, DVD players, 
and computers. The considerations relating to safeguarding of geographic data from unlicensed 
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19 uses also applies to data provided for these other types of devices. 
20 

21 SUMMARY 

22 The present invention provides a method and system for mass distribution of data. In 

23 accordance with an exemplary embodiment of the invention, an authorization server may be 
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1 coupled via a communications link with a plurality of data distribution terminals. The 

2 authorization server may maintain at least a first portion of each of a plurality of data products, 

3 such as geographic databases for instance. The first portion may define parameters (such as 

4 compression parameters and pointers) to which a machine must have access in order to be able to 

5 usefully access the data product. Each data distribution terminal may, in turn, maintain the 

6 remainder (i.e., a second portion) of each of a plurality of the data products. Thus, to establish a 

7 complete data product, the authorization server may provide the first portion to a given data 

8 distribution terminal, and the data distribution terminal may combine the portions together. 

9 A person may visit one of the data distribution terminals to request a given data product 

10 for use by a machine. The person may couple a portable data storage medium with the data 

11 distribution terminal, and the user may provide the terminal with identification and payment 

12 information. The terminal may then request the first portion of the data product from the 

13 authorization server, the authorization server may verify authorization to provide the data 

14 product, and the authorization server may then send the first portion to the terminal. The 

15 terminal may then combine the first and second portions together and write the combined data 

16 product to the data storage medium. The person may then remove the storage medium from the 

17 terminal and couple the storage device with the machine. The machine may then read the data 

1 8 product from the storage medium and use the data product. 

19 This arrangement is well suited for supplying data products of various sorts for use by 

20 machines of various sorts. In an exemplary embodiment, the data products may be geographic 

21 databases, for use by navigation systems (such as in-vehicle navigation systems, handheld 

22 (portable) navigation systems, or general purpose computing devices equipped with navigation 

23 system functionality, for instance). As other examples, the data products may be digitized songs 
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1 or videos (e.g., movies) for use by music or video players, or games for use by video game 

2 consoles. Other examples are possible as well. 

3 To help further secure the communication of the data product, the authorization server 

4 may also tie the first portion together with an authorization key, sending both the first portion 

5 and the authorization key to the data distribution terminal. The data distribution terminal may 

6 then record on the portable data storage medium both the first and second portions of the data 

7 product and the authorization key. In turn, the machine that reads the storage medium may use 

8 the authorization key to validate and/or facilitate its access to the data product. 

9 This added security feature may take various forms, hi one respect, for instance, the 
JrtO authorization server may encrypt the first portion of the data product before sending it to the data 
OH 1 terminal. A machine authorized to access the data product may have access to a first decryption 
Wl2 key necessary for decryption of the first portion and may therefore decrypt the first portion so as 
^13 to gain access to the data product. 

514 In another respect, the authorization server may establish an authorization key defining 

51 5 verification information, such as an identification of the machine authorized to access the data 

5 16 product and an identification of the data storage medium authorized to store a copy of the data 

17 product. The authorization server may encrypt the authorization key so as to produce an 

18 encrypted authorization key that can be decrypted using a second decryption key. The 

19 authorization server may then send to the data distribution terminal (i) the encrypted 

20 authorization key, and (ii) the encrypted first portion of the data product, and the data terminal 

21 may record this information onto the storage medium, together with the second portion of the 

22 data product. 
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1 In turn, a machine authorized to access the data product may use the second decryption 

2 key to recover the authorization key, and may then use the verification information defined by 

3 the authorization key to verify authorization to access the data product. If authorized, the 

4 machine may then use the first decryption key to decrypt the first portion of the data product, 

5 thereby gaining access to the full data product. 

6 Further advantageously, the second decryption key can itself be derived as a function of 

7 an environmental parameter (e.g., a system parameter) such as an ID of the machine authorized 

8 to access the data product or an ID of the storage medium authorized to hold the data product. 

9 With this arrangement, a machine seeking to access the data product should have the correct ID 
%0 and should obtain the correct ID from the storage medium, otherwise the machine may be unable 
ill to establish the second decryption key and may therefore be precluded from accessing the data 
0|2 product. Consequently, this arrangement helps prevent access to (and use of) the data product by 
H3 an unauthorized machine and further helps to prevent access to (and use of) the data product if 
l|4 the data product is recorded on (e.g., has been copied to) an unauthorized storage medium. 

|Jj5 In an alternative embodiment, the authorization server may provide some or all of a given 

El 6 data product more directly to the machine authorized to access the data product. For instance, 

17 the authorization server may send an encrypted authorization key and the encrypted first portion 

18 of the data product to the machine via a wireless telecommunications network (such as a cellular 

19 telephone system), for instance. The machine may acquire the other portion of the data product 

20 in the same way or by other means. For example, a person may visit a data distribution terminal 

21 to load a storage medium with the second portion of a selected data product, and the person may 

22 then couple the storage medium with the machine. To facilitate access to the data product, the 

23 machine may then request the authorization material (e.g.., the encrypted authorization key and 
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1 encrypted first portion) from the authorization server, and the authorization server may provide 

2 the requested material if the machine is authorized to receive it. 

3 These and other objects and advantages of the present invention will become apparent to 

4 those of ordinary skill in the art by reading the following detailed description, with appropriate 

5 reference to the accompanying drawings. 
6 



7 BRIEF DESCRIPTION OF THE DRAWINGS 

8 Preferred embodiments of the present invention are described herein with reference to the 

9 drawings, in which: 

Jjo Figure 1 is a block diagram illustrating a system arranged to facilitate mass distribution of 

Oil geographic data to one or more navigation systems in accordance with an exemplary 

^fl2 embodiment; 

f" 13 Figure 2 is a block diagram depicting an exemplary authorization server; 

Jjl4 Figure 3 is a perspective view of an exemplary data storage device for holding secured 

pi 15 data; 

Pl6 Figure 4 is a block diagram depicting components of the data storage device of Figure 3; 

17 Figure 5 is a block diagram of an exemplary data terminal; 

18 Figure 6 is a database having a critical portion and a data portion; 

19 Figure 7 is a block diagram of an exemplary navigation system; 

20 Figure 8 is a flow chart depicting an exemplary process that may be performed in order to 

21 provide a database of geographic data to portable data storage device; 
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1 Figure 9 is a flow chart depicting a set of functional blocks that may be involved in 

2 securing and providing data to a navigation system in accordance with an exemplary 

3 embodiment; 

4 Figure 10 is a flow chart depicting a set of functional blocks that may be involved in 

5 retrieval, decryption and validation of the data at the navigation system in accordance with an 

6 exemplary embodiment; 

7 Figure 1 1 is a flow chart illustrating a set of functional blocks that may be involved in an 

8 enhanced process of securing, conveying and accessing data in accordance with an exemplary 

9 embodiment; 

%0 Figure 12 is a flow chart illustrating a set of functional blocks that may be involved in 

ill another enhanced process of securing, conveying and accessing data in accordance with an 

Oh 2 exemplary embodiment; and 

^13 Figure 1 3 is a block diagram illustrating an alternative system arranged to facilitate mass 

Sl4 distribution of geographic data to one or more navigation systems in accordance with an 

IP 15 exemplary embodiment. 

El 16 
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1 DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS 

2 A. Exemplary System Architecture 

3 Referring to the drawings, Figure 1 is a block diagram illustrating an exemplary system 

4 10 arranged to facilitate distribution of geographic data to one or more navigation systems 16. 

5 System 10 includes an authorization server 12 arranged to be connected by a communications 

6 link 18 to a plurality of data distribution terminals 20. Each data distribution terminal is then 

7 arranged to provide data to a distribution medium 22, which is, in turn, arranged to provide the 

8 data to a navigation system 16. 

9 Communications link 18 can take any of a variety of forms and can include any number 
.llo of intermediate entities arranged to convey data from one point to another. For example, link 18 
|i l can include or take the form of a telecommunications network including wireless communication 
£42 interfaces (e.g., satellite, radio frequency (RF) cellular, or other interfaces) and/or landline 
H3 communication interfaces (e.g., the ISDN, cable, fiber, copper, or other interfaces). As a specific 
%4 example, link 18 may comprise the public switched telephone network. As another specific 
J45 example, link 18 may comprise the Internet, to which authorization server 12 and each data 
5 6 distribution terminal can be connected by a broadband (e.g., cable or DSL) connection, 

17 point-to-point connection, or other suitable link. 

18 Distribution medium 22 may take various forms as well and may vary from terminal to 

19 terminal and from navigation system to navigation system. For example, distribution medium 22 

20 may comprise an RF communications link between a terminal 20 and a navigation system 16. 

21 As another example, distribution medium 22 may comprise a wired communication link between 

22 a terminal 20 and a navigation system 16. 
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1 In the exemplary embodiment, distribution medium 22 comprises a portable data storage 

2 device, which can be selectively coupled to a distribution terminal 20 and to a navigation system 

3 16. Thus, in operation, geographic data can be communicated from authorization server 12 over 

4 link 18 to a data terminal 20. Data terminal 20 can then record data onto a portable data storage 

5 device 22, which can then be physically carried to, or otherwise coupled with, a navigation 

6 system 16. Navigation system 16 can then read the data from device 22 and use the data to 

7 provide navigation services for a user. 

8 This and other arrangements described herein are shown for purposes of illustration only, 

9 and those skilled in the art will appreciate that other arrangements and other elements (e.g., 
y 0 machines, interfaces, functions, etc.) can be used instead, additional elements may be added, and 
Gil some elements may be omitted altogether. Further, those skilled in the art will appreciate that 
PI2 many of the elements and interfaces described herein are functional entities that may be 
H3 implemented as discrete components or in conjunction with other components, in any suitable 
y 4 combination and location. 

EJ 5 It should also be understood that various functions described herein as being performed 

56 by one or more entities may be carried out by one or more processors executing an appropriate 

17 set of machine language instructions stored in memory. Provided with the present disclosure, 

18 those skilled in the art can readily prepare and compile appropriate computer instructions to 

19 perform such functions. 

20 Referring now to Figure 2, an exemplary authorization server 12 is shown in greater 

21 detail. Authorization server 12 may take the form of a general purpose computer programmed 

22 with a set of machine language instructions to carry out the functions described below. As 

23 shown in Figure 2, exemplary authorization server 12 may thus include a processor 26, a data 
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1 store 28, a memory 30 and a data interface unit 32. These components may be coupled together 

2 by a system bus or other link to facilitate communication. And the components may take various 

3 forms. By way of example, processor 26 may be an Intel Pentium III microprocessor, data store 

4 28 may be a flash memory, ROM and/or magnetic or optical hard disk drive, memory 30 may be 

5 volatile RAM (random access memory), and data interface unit 32 may comprise a transceiver, 

6 modem, antenna and/or other arrangement suitable for communicating over link 18. 

7 Although Figure 2 shows components of authorization server 12 within a single entity, 

8 those skilled in the art will appreciate that various components could equally be provided as 

9 separate entities. For example, all or part of data store 28 could be provided as a database server 
JtJ o with a separate processor that is accessible by processor 26 via a computer network or other link. 
Jil In an exemplary embodiment, data store 28 may hold three data components: (i) 
SJ2 geographic data 36, (ii) program logic 38, and (ii) authorization database 40. Geographic data 36 
Hi 3 may comprise one or more databases or data files that define geographical data, such as road 
% 4 geometry attributes and position information, and point-of-interest information. The road 

geometry attribute and position information may include data about the positions (e.g., latitude 

ft 6 and longitude coordinates) of streets and intersections in or related to a specific geographical 

17 area, information about one-way streets, street lights, stop signs, turn restrictions, street 

18 addresses, speed limits, and the like. Point-of-interest information may include data about the 

19 positions of airports, car rental agencies, service centers, restaurants, hotels, health clubs, and the 

20 like. The geographical data may include other or different data as well. 

21 Geographic data 36 may also include special databases of information. For example, 

22 geographic data may include Fodor's® Restaurant Guide or other such information, which 

23 authorization server 12 may provide together with a basic geographic database if desired. 
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1 Program logic 38 may comprise a number of machine language instructions that define 

2 routines executable by processor 26. In operation, these instructions can be loaded from data 

3 store 28 into memory 30 and then executed by processor 26 to carry out functions described 

4 below, such as establishing authorization keys and encrypting authorization keys and geographic 

5 data, for instance. Program logic 38 also includes an operating system (not shown), such as 

6 Unix, Linux® or Microsoft Windows®, for instance, 

7 Authorization database 40 may include information that identifies entities authorized to 

8 access and/or possess geographic data. The entities may be, for instance, a user, a navigation 

9 system and/or a data storage device (such as a flash memory card or other flash memory 
3o medium, for example). Thus, for example, a given user profile record may be keyed to a user ID 
ffji code and may indicate that (i) the user is authorized to obtain geographic data for a particular 
% 2 geographical area, (ii) a navigation system with a particular navigation system ID code is 
fss 13 authorized to access and use the geographic data, and (iii) a storage device with a particular 
Jj4 storage device ID code is authorized to hold the geographic data. 

MS Authorization database 40 may also define algorithms and keys that authorization server 

CI 6 12 may use to encrypt and/or otherwise secure geographic data. The process or keys used to 

17 encrypt or otherwise secure data may vary depending on the make and model of the navigation 

18 system that is expected to access the data, or depending on other factors. For instance, each 

19 model navigation system may have a predetermined decryption key that can be used to decrypt 

20 data encrypted using a corresponding encryption key and/or corresponding encryption algorithm. 

21 More specifically, each model navigation system may have its own private/public key pair. 

22 Authorization database 40 may therefore indicate, for each model navigation system, the 

23 encryption key and/or algorithm to be used for securing data that will be accessed by that model 
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1 navigation system. (Data could be encrypted using a private key and then decrypted by the 

2 navigation system using the corresponding public key, or vice versa.) 

3 In practice, the geographic data that is stored in data store 28 will be updated regularly, 

4 through a time consuming and costly process of surveying roads and points of interest and 

5 collecting and compiling data. Consequently, authorization server 12, and particularly data store 

6 28, is preferably maintained in a physically secure location, so as to guard against theft or 

7 misappropriation of the geographic data. Authorization server 12 may be owned and operated by 

8 a geographic data supply company, such as Navigation Technologies Corporation, of Rosemont, 

9 Illinois, which provides geographic data for use in mapping and navigation systems. 

yjo As indicated above, geographic data can be recorded on portable data storage device 22, 

oil which can then conveniently be provided to a navigation system 16. The storage device is 

®12 preferably portable (e.g., small and lightweight enough to carry), secure, nonvolatile, readable 

^"13 and re-writeable. Further, the storage device preferably has sufficient storage capacity to hold 

Jjl4 geographic data for a typical geographical area (such as a city, state, region, or any other sized 

r§ 15 area). Still further, to be robust, the storage device is preferably arranged to hold data in an 

oi6 appropriate format, such as the SDAL™ format available from Navigation Technologies 

17 Corporation or that is described in U.S. Patent Nos. 5,968,109, 5,974,419, and 5,953,722. 

18 However, storage device 22 can take other forms as well. 

19 In an exemplary embodiment, portable data storage device 22 takes the form of a flash 

20 memory card or PC card (PCMCIA card) with housing dimensions, interface dimensions and 

21 data storage capacity that conform with industry standards, recommendations or specifications. 

22 For example, if the storage device is a flash memory card, the device may confirm with size and 

23 capacity parameters conforming with SD Memory Card Specifications (available from the 
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1 Secure Digital Card Association of Palo Alto, California), which is well known to those skilled 

2 in the art. Such cards currently have dimensions of about 31 mm x 24 mm x 2.1 mm and have 

3 storage capacity of 32 megabytes or 64 megabytes of data. As another example, if the storage 

4 device is a PCMCIA hard disk card, the device preferably conforms with the PCMCIA standard 

5 (such as the PCMCIA Type III standard), which is well known to those skilled in the art. Such 

6 PCMCIA cards have dimensions of about 85 mm x 54 mm x 5 mm and are presently capable of 

7 storing about 440 megabytes of data. 

8 Figures 3 and 4 illustrate an exemplary portable data storage device 22 in the form of an 

9 SD-Card (e.g., a "SanDisk Secure Digital Memory Card," which is a flash memory card 
9o manufactured by SanDisk Corporation of Sunnyvale, California). Figure 3 shows the card in 
Si l perspective, and Figure 4 is a schematic block diagram illustrating functional blocks of the card. 
Il2 As shown, exemplary device 22 includes an external housing 102, internal flash memory or other 
H3 such storage segment 104, and a 9-pin serial interface 106 or other interface on or otherwise 
Cji4 extending from the housing. Housing 102 is preferably about 31 millimeters long, 24 
El5 millimeters wide and 2.1 millimeters thick, but may be any other desired dimensions as well. 
Si 6 Exemplary flash memory 104 may be large enough to hold 64 megabytes of data, by way of 

17 example, and is shown to include a set of data 108, such as geographic data and authorization 

18 parameters. Serial interface 106 comprises a set of pins or other connectors that can preferably 

19 be coupled with a corresponding entity to facilitate reading from, writing to and otherwise 

20 controlling the flash memory. 

21 As another example, the portable data storage device 22 could reside in (or could be) a 

22 personal data assistant ("PDA"), portable telephone or other such device. Many PDAs exist 

23 today and provide either substantial data storage capacity and/or the capability to add expansion 



- 15- 



N0064US 

1 data storage. Many PDAs include infrared communication ports or other wireless 

2 communication interfaces. In this regard, for instance, the Bluetooth™ specification for short 

3 range wireless communications could be employed to enable another entity, such as navigation 

4 system 16 for instance, to read from, write to, or otherwise communicate with the PDA. 

5 Portable data storage device 22 preferably has a unique identification (ID) code such as a 

6 serial number for instance. This storage device ID is preferably stored permanently in the 

7 storage device. For example, the storage device ID could be burned into ROM (read-only- 

8 memory) or other permanent storage portion of the device. 

9 As indicated above, each intermediate data terminal 20 may be arranged to receive some 
!jjo or all of data 108 from authorization server 12 and to write data 108 onto the portable data 
ffll storage device 22. Figure 5 is a schematic block diagram showing an exemplary data terminal 
SI 2 20 in greater detail. 

H3 Data terminal 20 can be a general purpose computer programmed with a set of machine 

^4 language instructions to carry out various functions. By way of example, data terminal 20 can be 

rd5 a personal computer in a home or business and may be accessible by a limited set of users. 

3 6 Alternatively, for example, data terminal 20 can be situated in, or can define, a kiosk or other 

17 public display and may be accessible in general by any users. 

18 As illustrated in Figure 5, data terminal 20 may include a processor 42, a data store 44, a 

19 memory 46, a data interface unit 48, a storage device interface 50, and a display 52. These 

20 components can be coupled together by a system bus (not shown). Further, each of these 

21 components may take various forms. By way of example, processor 42 may be an Intel Pentium 

22 III processor, data store 44 may be a flash memory, ROM and/or magnetic or optical hard disk 

23 drive, memory 46 may be RAM, data interface unit 48 may comprise a modem, transceiver, 
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1 antenna and/or other entity suitable for communicating over link 18 (as shown in Figure 1), 

2 interface 50 may be arranged as necessary to read and write data on portable data storage device 

3 22, and display 52 may be a VGA monitor. Other examples are possible as well. 

4 Similar to data interface unit 32 of the authorization server, the arrangement and 

5 operation of interface 50 may depend on the arrangement and operation of portable data storage 

6 device 22. For example, if device 22 is a flash memory card as illustrated in Figure 3, then 

7 interface 50 might comprise a flash card socket and controller as described above. As another 

8 example, if device 22 is a PDA with an infrared port, then interface 50 might comprise a 

9 corresponding infrared port and controller arranged to communicate data via infrared signals. As 

10 still another example, if device 22 includes an RF wireless transceiver, such as a transceiver 

1 1 conforming to the Bluetooth™ specification, then interface 50 could similarly include a wireless 

12 transceiver arranged to communicate data via RF signals. Interface 50 could take still other 

13 forms as well. 

14 Data store 44 may hold two data components: (i) geographic data 54 and (ii) program 

15 logic 56. Geographic data 54 can take various forms. For example, geographic data 54 can 

16 comprise one or more databases of geographical data each corresponding, respectively, to one or 

17 more geographical areas or types of information. However, in an exemplary embodiment, 

18 geographic data 54 preferably contains only a portion of each database of geographic data that is, 

1 9 by itself, not usefully accessible by a navigation system. 

20 In this regard, a database or other such data product can include a set of critical 

21 information (critical data) that permits the entire data product to be used. The critical 

22 information could take various forms. For instance, the critical information could include a 

23 number of indexes, pointers or global parameters that enable a machine (such as a computer 



- 17- 



N0064US 

1 processor) to access the data product. As an example, for instance, a database may define a 

2 number of records or other parcels of information, and the critical information in the database 

3 may define pointers to where in the database the records or other parcels begin. As another 

4 example, the useful data in a database may be compressed or encrypted using various algorithms 

5 and parameters, and the critical information may serve as a key to the data by specifying the 

6 parameters or algorithms that a machine should use in order to decompress or decrypt the data. 

7 As yet another example, a number of records in a database may include a code representative of 

8 a useful data value, and the critical information in the database may define (or point to) the 

9 corresponding data value. Without access to the critical information, a machine may therefore be 
"So unable to access the useful data in the database. 

Si l The critical information in a database may be stored in one block in the database or may, 

mi alternatively, be distributed throughout the database. As an example, the information may be 

Hl3 stored in a header or other block at the beginning of the database. As another example, the 

%4 information may comprise a number of indexes and other general parameters disposed at the 

Ss beginning of each of a number of parcels throughout the database. Typically, the critical 

5 6 information will comprise a relatively small portion of the database. 

17 To illustrate, Figure 6 depicts a database 58 that has a critical portion 60 and a data 

18 portion 62. Although Figure 6 shows these portions as discrete blocks, the two may be 

19 interspersed with each other or arranged differently in the actual database. In general, the critical 

20 portion 60 contains some or all of the critical information that serves as a key to facilitate access 

21 to data in the data portion 62. 

22 In an exemplary embodiment, the geographic data 54 contained in the data store 44 of the 

23 terminal 20 excludes some or all of the critical portion 60 of each database product. In one 
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1 embodiment, the geographic data 54 contained in the terminal 20 excludes an arbitrary-sized 

2 portion of each database product. The excluded arbitrary-sized portion corresponds to some or 

3 all the critical portion of each database product. In one embodiment, the arbitrary-sized portion 

4 corresponds to the first two kilobytes of the database product. Alternatively, the first two 

5 kilobytes might not correspond exactly to the critical information portion of a geographic 

6 database product. For example, the first two kilobytes may not include all the critical 

7 information of the database product or may include all the critical information as well as some of 

8 the data portion of the database product. However, by excluding the first two kilobytes of each 

9 database, enough of the critical portion is excluded so as to render the remainder unusable. In 
^flO alternative embodiments, the arbitrary-sized portion may correspond to sizes other than two 
5i i kilobytes or parts of the database product of than the first part. 

ffll2 The geographic data 54 stored at the terminal 20 may include just the remaining portions 

1^13 of each database product with the arbitrary-sized portions excluded. Alternatively, the 

^14 geographic data 54 stored at the terminal 20 may include entire database products with the 

El 5 portions corresponding to the arbitrary-sized excluded portions replaced with random or 

Pi 1 6 otherwise useless data. 

17 In turn, the geographic data 36 in the data store 28 of the authorization server 12 

18 preferably includes at least the arbitrary-sized portions of each database that are not stored at the 

19 terminals 22. In this regard, the geographic data 36 maintained by the authorization server may 

20 comprise the entire databases of geographic information, and the authorization server may be 

21 programmed to parse the arbitrary-sized portions from a given database for transmission to a 

22 terminal 20 upon authorization. Alternatively, in an exemplary embodiment, the authorization 



- 19- 



N0064US 

1 server may regularly maintain the critical portion of each database as a discrete data block ready 

2 to send to a terminal upon authorization. 

3 Advantageously, with this arrangement, a person or other entity with access to data stored 

4 in terminal 20 can be prevented from using the databases without proper authorization, and 

5 namely without access to the actual critical portions of the databases. At the same time, 

6 however, terminal 20 can readily obtain the necessary critical information from authorization 

7 server 12 when appropriate and can record both the critical portion 60 and the data portion 62 on 

8 storage device 22 for use by navigation system 16. 

9 Authorization server 12 may provide geographic data 54 via link 1 8 to each data terminal 

50 20 periodically, upon request, or in response to other designated stimuli. Authorization server 12 

51 l may, for example, send geographic data 54 to data terminal 20 via link 18 in off-hours, such as 
ft 2 overnight for instance. This way, if link 18 has limited bandwidth (e.g., if link 18 is the public 
H3 switched telephone network, and authorization server 12 and terminal 20 communicate with each 
%4 other over link 1 8 via a 56 kbps modem connection, or if link 1 8 comprises a network such as the 
Sf5 Internet that tends to be congested during normal daytime hours, for instance), geographic data 
Q16 54 can be conveyed with little if any concern. 

17 Alternatively, geographic data 54 could be provided to data terminal 20 in some other 

18 manner. For example, geographic data 54 could be loaded onto a CD ROM, which can be 

19 physically sent to data terminal 20. A technician can then insert the CD ROM into a suitable CD 

20 ROM drive in the data terminal or an arrangement could be in place to read the data from the CD 

21 ROM into data store 44. 

22 Program logic 56 may comprise a number of machine language instructions that define 

23 routines executable by processor 42. In operation, these instructions can be loaded from data 
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1 store 44 into memory 46 and then executed by processor 42 to carry out various functions such 

2 as interfacing with a user via display 52 and sending data to interface 50, to be written to 

3 portable data storage device 22. Program logic 56 also includes an operating system (not 

4 shown), such as Unix, Linux® or Microsoft Windows®, for instance. 

5 Data terminal 20 preferably has a unique terminal ID. This ID could be a network 

6 address of the terminal or could be a more permanent terminal identifier. In the exemplary 

7 embodiment, the terminal ID could be stored permanently in ROM or in another suitable manner. 

8 Referring now to Figure 7, an exemplary navigation system 16 is illustrated in greater 

9 detail. Exemplary navigation system 16 could be an in-vehicle navigation system or could reside 

10 in a handheld (i.e., portable) device or other entity, such as a cellular telephone, PDA, pager, 

1 1 computer or dedicated mapping or positioning device, for instance. Other examples are possible 

12 as well. 

13 In an exemplary embodiment, navigation system 16 includes a processor 64, a data store 

14 66, a memory 68, a data interface unit 70, a positioning system 72, a display 74, and a user input 

15 mechanism 76. These components may be coupled together by a bus or other communications 

16 path. And the components can take various forms. By way of example, processor 64 may be an 

17 Intel Pentium III microprocessor, data store 66 may be a flash memory, ROM and/or magnetic or 

18 optical hard disk drive, memory 68 may be volatile RAM, data interface unit 70 may be any 

19 interface suitable for facilitating communications with distribution medium 22, display 74 may 

20 be an LCD display and/or other means (audible or visual) for presentation, and user input 

21 mechanism 76 may be a keyboard, control knob or microphone, for instance. 

22 In the exemplary embodiment, positioning system 72 outputs information about the 

23 position of the navigation system (e.g., the position of a vehicle in which the system is located, 
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1 or the position of a person carrying the system, for instance). This information may be in terms 

2 of latitude and longitude, distance and heading, or other suitable parameters. Positioning system 

3 72 may comprise a GPS receiver, the arrangement and operation of which are well known to 

4 those skilled in the art. Alternatively, positioning system 72 can take other forms. Positioning 

5 system 72 also preferably includes an antenna 78 or other such device for receiving GPS 

6 positioning signals from satellites or for receiving position information from other types of 

7 entities. 

8 Data store 66 may hold navigation program logic 80, which may comprise a number of 

9 machine language instructions that can be loaded into memory 68 and executed by processor 64 
frfo to perform various functions, such as decrypting and validating data, and providing navigation 
|ll services, for instance. Data store 66 also holds an operating system (not shown), such as Unix, 
TO2 Linux® or Microsoft Windows CE®, for instance, which can also be loaded into memory 68 and 
H3 executed by processor 64. Program logic also includes a data access library used to access data 
5U libraries such as SDAL, as described for instance in U.S. Patent No. 6,047,280 (the '280 patent), 
gf 5 the entirety of which is hereby incorporated by reference. 

3 6 Although not shown in Figure 7, data store 66 can also hold other information, such as 

17 geographic data for instance. In that event, navigation system 16 could obtain geographic data 

18 via data interface unit 70 and store the geographic data in data store 66 or memory 68. This 

19 geographic data may, for instance, be the data portion 62 of one or more geographic databases, 

20 as shown in Figure 6 and described above. With this arrangement, the navigation system would 

21 not be able to usefully access the geographic data of a given database until the navigation system 

22 obtains the critical portion 60 of the database as well. In the exemplary embodiment, however, 
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1 geographic data is primarily maintained on portable data storage device 22 and is read by 

2 processor 64 into memory 68 from device 22. 

3 In the exemplary embodiment, as noted above, data interface unit 70 serves to facilitate 

4 communication with portable data storage device 22. Therefore, data interface unit 70 preferably 

5 includes a port for communicating with storage device 22. Similar to the interface 32 of the 

6 authorization server and interface 50 of terminal 20, the arrangement and operation of data 

7 interface unit 70 may depend on the arrangement and operation of portable data storage device 

8 22. Thus, data interface unit 70 might comprise a flash card socket, an infrared port, and/or an 

9 RF transceiver, for example. 

^10 Some or all of the components of navigation system 16 are preferably located in positions 

j^l 1 where they are readily accessible to a user for whom navigation services are to be provided. For 

ggl2 example, if navigation system 16 is an in-vehicle navigation system, display 74 and user input 

yi3 mechanism 76 may be integrated in the vehicle dashboard for easy access by a driver, and the 

£3l4 other components of the system can be hidden behind the dashboard or in another suitable 

^15 location. 

jS-16 Data interface unit 70 may also be provided in the vehicle dashboard or could be hidden 

17 from view, depending on how the data interface unit 70 is arranged to communicate data. For 

18 example, if data interface unit 70 is arranged to communicate with portable data storage device 

19 22 via an electrical connection, then data interface unit 70, or at least an electrical connection to 

20 the unit, will preferably be exposed to facilitate user access. For instance, data interface unit 70 

21 could be arranged as a socket or slot within the vehicle dashboard, into which a flash card could 

22 be inserted, similar to the socket described above On the other hand, if data interface unit 70 is 
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1 arranged to communicate with portable data storage device 22 via a wireless link, for instance, 

2 then unit 70 could be hidden from the user. 

3 Similarly, if navigation system 16 is provided in a handheld device, such as a PDA, a 

4 cellular telephone or a dedicated positioning device, for instance, some of the components can be 

5 provided on the exterior surface of the device so as to facilitate user interaction, and other 

6 components can be hidden within the device. For example, on a PDA, a touch-sensitive display 

7 could serve as both display 74 and user input mechanism 76, and an expansion port or other link 

8 (e.g., an infrared port or antenna) could serve as the data interface unit 70. Other components of 

9 the navigation system can then be incorporated internally with the normal components of the 

10 PDA. 

11 In an exemplary embodiment, navigation system program logic 80 uses the output of 

12 positioning system 72, in combination with geographic data 108 stored on the portable storage 

13 device 22, to provide navigation services, features and information to a user of the navigation 

14 system. Using output from the positioning system 72 and geographic data 108, program logic 80 

15 preferably provides a map 82, a direction indicator (e.g., a turn arrow) and/or other information 

16 on display 74. A map 82, for instance, may illustrate the location of the navigation system in a 

17 given geographical area. Program logic 80 may provide information about what points of 

18 interest are available, distances to various points of interest, directions (visual and/or audible) to 

19 a desired destination, such as a street address or point of interest, and so forth. User input 

20 mechanism 76, which may comprise a control knob, keyboard, or microphone, for instance, 

21 allows a user to specify a desired destination, in response to which program logic may generate 

22 and display directions to the destination. 
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1 Navigation system 16 will likely have a specific make (vendor) and model number. 

2 Additionally, navigation system 16 preferably has a unique navigation system ID, such as a serial 

3 number or other code. In addition to uniquely identifying the navigation system, the navigation 

4 system ID may also be indicative of the navigation system make and model. In an exemplary 

5 embodiment, the navigation system ID is stored permanently in the navigation system, such as in 

6 ROM for instance. 

7 Navigation systems as described above can be manufactured and assembled and then 

8 sold, rented or otherwise distributed to consumers through any suitable distribution channels. 

9 For example, in- vehicle navigation systems can be sold or rented by car dealerships as optional 
Jo or standard equipment in vehicles. As another example, retail stores may sell dedicated GPS- 
mi based navigation devices to users. As still another example, vendors may sell or otherwise 
ib provide software navigation systems that use geographic data to generate maps and directions, 
Hi3 even without including or using positioning systems. Such navigation applications can be 
%4 executed by a computer that has functional elements similar to those of navigation system 16, for 
k45 instance. 

f| 6 When a user obtains navigation system 16, the user may also obtain a navigation system 

17 ID card, which identifies the navigation system by its model number and navigation system ID. 

18 The information on the card may be machine readable, such as via a magnetic strip or RF tag for 

19 instance. The user may also obtain a user ID card or other indication of a user ID, which 

20 uniquely identifies the user. The user ID card may similarly indicate the user ID in machine 

21 readable form. 
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1 B. Exemplary Provisioning of Geographic Data 

2 In order for navigation system 16 to provide navigation services, it should have access to 

3 a database or other set of geographic data. With the exemplary embodiment as described above, 

4 a database of geographic data can be provided to navigation system 16 on portable data storage 

5 device 22. Therefore, according to the exemplary embodiment, when a user first obtains 

6 navigation system 16, the user preferably also obtains a portable storage device 22, suitable for 

7 containing geographic data. The user may obtain the data storage device 22 from the same entity 

8 that provided the user with the navigation system 1 6. 

9 For instance, when a user obtains a car that has a navigation system installed as standard 
yo equipment, the car may come with a portable data storage device 22 as well As another 
Si 1 example, when a user buys a navigation system at a retail outlet, the system may also include a 
IB 2 portable data storage device 22. Alternatively, the user may purchase the portable data storage 
H3 device separately or obtain the device at some other time or in some other way. 

MU When the user first obtains the portable data storage device 22, the storage device might 

p5 come pre-loaded with geographic data for a specific geographical area (such as a city, state or 

3 6 other region, for instance). In that event, however, the user may at some point wish to update the 

17 set of geographic data on device 22 so as to have the data reflect more current road conditions 

18 and points-of-interest. Alternatively, the user may at some point wish to replace the geographic 

19 data on the storage device with geographic data for a different geographical area. Still 

20 alternatively, storage device 22 may not contain any geographic data to start. In that event, the 

21 user may wish to load a set of geographic data onto the storage device to facilitate operation of 

22 the user's navigation system in a given geographic area. 
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1 Various processes may be employed in order to load a geographic database onto portable 

2 storage device 22. As indicated above, for example, authorization server 12 can send some or all 

3 of the database to intermediate terminal 20, and terminal 20 can then record the database onto 

4 storage device 22. Figure 8 is a flow chart depicting an exemplary process that may be 

5 performed in order to provide a database of geographic data to portable data storage device 22 in 

6 this way, and in turn to provide the data for use by a navigation system 16. 

7 As shown in Figure 8, at block 150, a user first couples storage device 22 with the 

8 interface 50 of terminal 20. For example, if storage device 22 is a flash card, the user may insert 

9 the card into a corresponding flash card socket at terminal 20. At block 152, terminal 20 detects 
tAo the presence of storage device 22 and reads the storage device ID from the permanent storage 
Ml portion of storage device 22. In this example, terminal 20 may also attempt to read geographic 
|B2 data from the storage device and determine that the storage device does not yet contain 
Hi 3 geographic data. 

At block 154, terminal 20 then preferably prompts the user to input the user's ID (and 

jr!l5 perhaps a personal identification number (PIN)) and the navigation system ID in connection with 

S6 which the user will want to use the geographic data. At block 156, the user supplies this 

17 information. As indicated above, the navigation system ID and user ID can be encoded in 

18 machine readable form on one or more ID cards. Terminal 20 may include means for reading 

19 those cards and obtaining the user and system IDs. Alternatively, for instance, the user could 

20 type or otherwise enter the user ID and navigation system ED into the data terminal. 

21 At block 158, terminal 20 may then prompt the user to select from a menu of 

22 geographical regions for which geographic data can be loaded onto device 22. The menu may, 

23 for instance, list all of the regions for which data store 44 of terminal 20 currently contains 
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1 geographic data. (As noted above, in an exemplary embodiment, data store 44 may contain 

2 geographic data in the form of only the data portions 62 of various geographic databases. Each 

3 data portion maintained by terminal 20 could be labeled or otherwise cross-referenced to 

4 correspond with a particular geographical region.) 

5 At block 160, the user may then select a desired region (or multiple regions). At block 

6 1 62, terminal 20 may then responsively prompt the user to indicate whether the user wishes to (i) 

7 purchase the data or (ii) rent the data for a certain period of time or for a certain number of uses. 

8 At block 164, the user may respond by selecting either "purchase" or "rent" with specified time 

9 or uses for instance. 

hio At block 166, terminal 20 may also prompt the user to select from a number of special 

frtl geographic data options. These options may take various forms. For instance, an option might 

Hi 2 be for the user to be able to access Fodor's® Restaurant Guide and/or special geographic areas on 

^13 navigation system 16. Each option might have a corresponding option number. And terminal 20 
may also prompt the user to select a desired period of use or number of uses for a given option. 

mis At block 168, the user may respond to the terminal by selecting one or more options and criteria 

Ql 6 for use. 

17 At block 170, terminal 20 may then prompt the user to supply payment information, such 

18 as a credit or debit card number for instance. And at block 172, the user may provide the 

19 requested payment information. In an exemplary embodiment, the dealer that sold the user the 

20 navigation system 16 and/or the storage device 22 may have provided the user with a pre- 

21 payment code, which the user may supply to terminal 20 to satisfy payment. The dealer could 

22 then be ultimately accountable for the payment. 
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1 At block 174, terminal 20 then sends via link 18 to authorization server 12 a set of 

2 information preferably including (i) the user ID, (ii) the storage device ID, (iii) the navigation 

3 system ID, (iv) the selected geographic region (which might be the database name, for instance), 

4 (v) rental time period or times of use, if applicable, (vi) options and periods or numbers of use of 

5 options, (vii) the terminal ID, and (viii) the payment information. Authorization server 12, in 

6 turn, receives this set of information. 

7 At block 176, authorization server 12 queries its authorization database 40 to determine 

8 whether the user is already authorized to receive the requested geographic data to be stored on 

9 the specified storage device and accessed by the specified navigation system. This query may be 
^0 keyed to the user ID provided from terminal 20 for instance. This example will assume that a 
fill user record does not yet exist in authorization database 40. 

ffi2 In addition, if the user has provided a PIN in connection with the user ID, the 

43 authorization server may verify that the PIN is correct, by reference to a PIN table in the 

^4 authorization database 40. In the event the PIN is not correct, the authorization server may 

5 5 return a signal to the data terminal, indicating that the session cannot continue absent a correct 

5 6 PIN - 

17 At block 178, finding no corresponding user record, authorization server 12 establishes a 

18 user record indicating that, for the user having the user ID, the storage device having the storage 

19 device ID is authorized to hold a particular database of geographic data, and the navigation 

20 system having the navigation system ID is authorized to access the particular database of 

21 geographic data. Further, to the extent the user elected to rent the data for only a specific time 

22 period or for a number of uses, authorization server 12 may record in the user record an 
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1 expiration date or a count of number of allowed uses. At block 180, authorization server 12 may 

2 then prepare and send data to terminal 20, to be written to storage device 22. 

3 Authorization server 12 can send to terminal 20 the entire database of geographic data 

4 corresponding to the region selected by the user. (This database may be referred to as the 

5 "selected database.") However, in the exemplary embodiment, terminal 20 is assumed to already 

6 have the data portion 62 of the database stored in its data store 44. Therefore, conveniently, 

7 authorization server 12 will preferably send only the critical portion 60 of the database to 

8 terminal 20. Advantageously, this will take far less time than it would take for the authorization 

9 server to send the entire database to terminal 20. 

10 When the critical portion 60 is combined with the data portion 62 of the database that is 

1 1 stored in data store 44 of terminal 20 and the combination is provided to a system such as 

12 navigation system 16, the system should be able to use the critical portion as a key to access the 

13 data in the database. However, as noted above, the exemplary embodiment seeks to avoid some 

14 of the risks associated with releasing valuable information such as geographic data. Therefore, 

15 rather than simply sending the critical portion (or the entire database, if desired) to terminal 20, 

16 authorization server 12 preferably first encrypts and/or otherwise secures the critical portion (or 

17 entire database), producing a set of secure data, so as to avoid unauthorized use of the database. 

1 8 Details of how this process may work in practice will be provided below. 

19 At block 182, terminal 20 receives the secure data sent from authorization server 12. At 

20 block 184, terminal 20 then writes to portable data storage device 22 (i) the data portion of the 

21 database, which terminal 20 maintained in its data store 44, and (ii) the secure data that terminal 

22 20 received from authorization server 12. As a result, at this point, data storage device 20 

23 contains a secure copy of the selected database. 
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1 At block 186, terminal 20 then informs the user that storage device 22 is ready for use. 

2 Therefore, at block 188, the user removes the storage device from communication with terminal 

3 20 and, at block 190, the user communicatively couples the storage device with navigation 

4 system 16. For example, if storage device 22 is a flash card, the user may insert the device into a 

5 corresponding flash card socket of navigation system 16. As another example, if storage device 

6 22 has a Bluetooth™ RF interface, the user may bring device 22 within an appropriate range of 

7 navigation system 16 so as to couple device 22 with a corresponding data interface unit 70 of the 

8 navigation system. 

9 At block 192, navigation system 16 is then powered up or receives a request to provide 
H10 navigation services. For example, the user may engage user interface mechanism 76 in order to 
~ j 1 instruct the navigation system that the user wants to travel to a specified destination address or 
02 point of interest. In response, the navigation system would ordinarily retrieve geographic data 
hA3 from data storage device 22 and use that data in combination with positioning information 
Q4 provided by positioning system 72 to generate map 82 showing the user how to get to the 
Jtl5 specified destination. 

Jj6 In the exemplary embodiment, at block 194, navigation system 16 may detect the 

17 presence of device 22. In turn, at block 196, navigation system 16 may responsively seek to 

18 access the database on the storage device. To do so, navigation system 16 preferably performs a 

19 process to validate and/or facilitate access to the database. This process will depend on the 

20 process used to secure the database. The process may be predetermined and/or may be identified 

21 by a message stored on storage device 22 together with the set of secure data. Details of how 

22 this process may work in practice will be provided below as well. 
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1 At block 198, assuming that the navigation system is precluded from accessing the 

2 geographic data stored on device 22, the navigation system may audibly and/or visually alert the 

3 user that navigation services are unavailable. In doing so, the navigation system may present on 

4 display 74 the reasons for refusal of service. Further, in an exemplary embodiment, possibly 

5 depending on the reasons for denial of service, the navigation system may send a message to a 

6 central office to report the failed attempt. The navigation system may, for instance, send the 

7 message over a wireless telecommunications network as an industry standard short message 

8 service (SMS) message or in another manner. 

9 Alternatively, at block 200, assuming that the navigation system can properly and 

10 successfully access the geographic data stored on device 22, the navigation system will do so. 

1 1 The system may then use the geographic data to provide the navigation services requested by the 

12 user. 

13 C. Exemplary Securing of Data and Secure Communication of Data 

14 As noted above, the process of securing the data, and securely communicating the data, 

15 can take various forms. Generally speaking, by way of example, the process may involve (i) 

16 encrypting the critical portion 60 so as to establish an encrypted critical portion that can be 

17 decrypted using a decryption key, (ii) establishing a set of authorization parameters useful for 

18 validating and/or facilitating access to the database, and (iii) tying the authorization parameters 

19 to the encrypted critical portion. At the receiving end, such as a navigation system 16, the 

20 process may then involve (iv) using the authorization parameters to validate and/or facilitate 

21 access to the database, (v) using the decryption key to decrypt the encrypted critical portion, and 

22 then (vi) using the critical portion to facilitate access to the data portion of the database. This 

23 process may facilitate securing the data, while allowing the data to be used in connection with 



-32- 



N0064US 

1 one or more authorized entities (such being stored on a given data storage medium, or being used 

2 by a given navigation system, for instance). Figures 9, 10, 11 and 12 are flow charts showing 

3 specific examples of how this process may work in practice. 

4 Figure 9 illustrates a set of functional blocks that may be involved in securing and 

5 providing data to a navigation system in accordance with an exemplary embodiment of the 

6 invention. As shown in Figure 9, at block 250, the authorization server generates a random key 

7 (e.g., bit string) to be associated with the selected database. (As understood in the art, it may be 

8 impossible to generate a truly "random" key. However, techniques are well known for 

9 generating substantially random data, and those techniques may be employed here. In this 
.hi 0 regard, the term "random" may be equated with the term "substantially random.") At block 252, 
ffl l the authorization server then uses the random key to symmetrically encrypt the critical portion 60 
3-12 of the database, so as to produce an encrypted critical portion that can be decrypted using the 
^3 random key. 

9 4 Methods of symmetric encryption are very well known in the art and others may be 

5 5 developed in the future as well. Examples of suitable symmetric encryption methods include the 

Q16 Advanced Encryption Standard (AES) and "Two Fish" by Bruce Schneier. Similarly, other 

17 suitable methods of encryption, such as public key / private key encryption are also well known 

18 in the art. Examples of such methods include elliptical curve cryptography, pretty-good-privacy 

19 (PGP) and RSA. These and other encryption methods are well known to those skilled in the art 

20 and are described, for instance, in Schneier, B., "Applied Cryptography ~ Protocols, Algorithms, 

21 and Source Code in C," Chapters 11-14, 18-19 and 24 (2d ed., John Wiley & Sons, Inc. 1996), 

22 and Schneier, B. et al., "Twofish: A 128-Bit Block Cipher," http://www.counterpane.com/ 

23 twofish.html (June 15, 1998), both of which are hereby incorporated by reference. 
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1 At block 254, the authorization server next assembles a set of authorization parameters 

2 and combines the parameters to establish an authorization key that includes verification 

3 information useful for validating use of the database. In the exemplary embodiment, these 

4 parameters may comprise the following, for instance: 

5 1 . SYSTEM INFORMATION. These parameters may include information 

6 indicating entities of the system that are authorized to possess and/or access the 

7 selected database. These parameters preferably include (i) the navigation system 

8 ID and (ii) the data storage ID. 

9 2. DATABASE INFORMATION. These parameters may define information about 

10 the specific database that is being provided. For instance, this information may 

1 1 include (i) the database name, which may be indicated by a field in the database, 

12 (ii) a unique serial number, which the authorization server has inserted into the 

13 critical portion to identify the copy of the database, (iii) the database version (e.g., 

14 revision number) (iv) a randomly generated index into the critical portion, and the 

15 32-bit value stored at that index, and (v) optional database information selected by 

16 the user, such as Fodor's® Restaurant Guide, for instance. 

17 3 . DATABASE DECRYPTION KEY. This parameter is the decryption key that can 

18 be used to decrypt the encrypted critical portion. Given that the authorization 

19 server symmetrically encrypted the critical portion with the randomly generated 

20 key, this decryption key is the randomly generated key. However, this parameter 

21 may vary depending on the type of encryption performed and consequently on the 

22 type of decryption required. 
23 
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1 

2 4. ACCESS LIMITATIONS. These parameters may include (i) a data range during 

3 which the database and/or a specific option is authorized to be used and (ii) a 

4 count of the number of times the database and/or option is authorized to be 

5 accessed. 

6 5 . TRACING INFORMATION. These parameters may define information that can 

7 be used by a geographic data provider to trace the source of fraudulent copies of 

8 geographic data. These parameters may include, for instance, (i) the user ID, (ii) 

9 the navigation system ID, make and model, (iii) the time and date that the 
y 0 authorization key is being generated, and (iv) the data terminal ID. 



rtl Alternatively, the parameters may take other forms as well. Authorization server 12 may 

83 2 combine these parameters together in any desired manner to establish the authorization key. For 

H3 instance, assuming that each parameter can be represented as a character string or bit string, 

y 4 authorization server 12 can concatenate or interleave the character strings or bit strings. At block 
256, the authorization server preferably also computes a CRC or checksum of the authorization 

Pi 6 key and appends or otherwise adds that CRC or checksum to the authorization key. (As used 

17 herein, the terms "CRC" and "checksum" can be considered to be equivalent. Further, other 

18 types of hash functions could also be considered to be equivalent as well.) 

19 At block 258, the authorization server then encrypts the authorization key so as to 

20 produce an encrypted authorization key that can be decrypted with a particular decryption key. 

21 As noted above, each model of a navigation system preferably has its own private/public key 

22 pair, and the encryption key to be used for the given model is preferably stored in the 

23 authorization server authorization database 40. (As further noted above, the authorization server 
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1 may encrypt using the private key, allowing the navigation system to decrypt using the public 

2 key. Alternatively, the authorization server may encrypt using the public key, allowing the 

3 navigation system to decrypt using the private key.) Thus, given the navigation system ID 

4 (which may define or cross-reference to a navigation system model number, for instance), the 

5 authorization server may retrieve the applicable encryption key from authorization database 40 

6 and may use that encryption key to encrypt the authorization key. 

7 At block 260, the authorization server then preferably sends to terminal 20 via link 18 (i) 

8 the encrypted critical portion of the database and (ii) the encrypted authorization key. At block 

9 262, as described above, terminal 20 may then record the encrypted critical portion, the 
^ 10 encrypted authorization key, and the data portion 62 onto data storage device 22. And, at block 
:^ 1 1 264, a user may couple device 22 with navigation system 16. 

03 12 Figure 10 next illustrates a set of functional blocks that may be involved in retrieval, 

13 decryption and validation of the data at the navigation system. The functions performed in these 

Cl4 blocks may be performed in the interface layer software described in the '280 patent, for 

^ 15 instance, and, more particularly, in the media device isolation layer described therein. Referring 

m pA6 to Figure 10, at block 266, navigation system 16 may first read the encrypted authorization key 

17 from device 22. At block 268, the navigation system will then apply its designated decryption 

18 key to decrypt the encrypted authorization key so as to produce a plaintext authorization key. In 

19 the exemplary embodiment, if the user tries to use the database in connection with a navigation 

20 system that is not the model corresponding to the navigation system ID that the user provided, 

21 the navigation system will not have the correct decryption key and therefore will not be able to 

22 access the data. 



-36- 



N0064US 

1 At block 270, assuming successful decryption of the encrypted authorization key, the 

2 navigation system may then use some or all of the authorization parameters to validate (i.e., 

3 establish authority to use) the database. By way of example, the navigation system may read the 

4 storage device ID from the permanent memory of storage device 22 and may determine whether 

5 that storage device ID matches the storage device ID provided in the authorization key. If the 

6 storage device ID does not match, the navigation system may conclude that the storage device 

7 contains an unauthorized copy of the database, and the navigation system may therefore refuse to 

8 access the database. 

9 As another example, the navigation system may determine whether its own navigation 
4 0 system ID matches the navigation system ID provided in the authorization key. If the navigation 
5f 1 system ID does not match, the navigation system may conclude that it is not authorized to access 

the database, and the navigation system may therefore refuse to access the database. 

Ml 3 As still another example, the navigation system may use the access limitations, such as a 

Dl4 rental period or use restriction, to determine whether access is currently authorized. Specifically, 

«15 for example, the navigation system may determine whether the current date (as provided by the 

JSJi6 GPS positioning system, for instance) falls within the date range specified in the authorization 

17 key and, if the date falls outside the range, may refuse to access the database. 

18 At block 272, with successful validation, the navigation system may then decrypt the 

19 encrypted critical portion. In particular, the navigation system may (i) read into memory 68 from 

20 the storage device 22 the encrypted critical portion, (ii) retrieve from the authorization key the 

21 decryption key required for decryption of the encrypted critical portion, and (ii) use the 

22 decryption key to decrypt the encrypted critical portion. 
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1 At block 274, the navigation system may then use the information within the critical 

2 portion 60 (e.g., decompression information, indexes and pointers) as keys to access the 

3 geographic data in the data portion 62. In the exemplary embodiment, the data portion remains 

4 stored on data storage device 22, while the decrypted critical portion is stored in the volatile 

5 memory 68 of the navigation system 16. As long as storage device 22 remains coupled with 

6 navigation system 16, the navigation system may thereby continue to access the database of 

7 geographical data so as to provide navigation services. When storage device 22 is removed from 

8 communication with navigation system 16 or at another suitable time, the decrypted critical 

9 portion is preferably cleared from memory 68, thereby preserving the security of the data 
4:0 portion. 

pi 1 While the foregoing provides a robust method of securing geographic data, an alternative 

mi process can be employed so as to provide enhanced security. In the alternative process, 

H3 authorization server 12 can instead symmetrically encrypt the authorization parameters and use 

H4 public/private key encryption to encrypt only the symmetric key, preferably together with a value 
representative of the authorization key, rather than to encrypt the entire authorization key. 

3 6 Figure 11 is a flow chart illustrating a set of functional blocks that may be involved in this 

17 alternative process. 

18 As shown in Figure 1 1, at block 350, the authorization server generates a random key to 

19 be associated with the selected database. At block 352, the authorization server then uses the 

20 random key to symmetrically encrypt the critical portion of the database, so as to produce an 

21 encrypted critical portion that can be decrypted using the random key. 

22 At block 354, the authorization server then assembles a set of authorization parameters 

23 and combines the parameters to establish an authorization key. These parameters may be those 
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1 described above, for instance, including the random key necessary for decryption of the 

2 encrypted critical portion. 

3 At block 356, the authorization server computes a checksum or CRC, C, of the 

4 authorization key. At block 358, the authorization server then generates a random value, R, and 

5 uses R to symmetrically encrypt the authorization key, rather than public key encrypting the 

6 authorization key. 

7 At block 360, the authorization server combines together the values C and R, such as by 

8 concatenating or interleaving the values for instance, to produce a value V. At block 362, the 

9 authorization server uses the private key (associated with the navigation system model) to 
y 0 encrypt the value V. Finally, at block 364, the authorization server sends to terminal 20 (i) the 
Sil encrypted value V, (ii) the encrypted authorization key, and (ii) the encrypted critical portion. 
M2 Upon receipt of this information, at block 366, terminal 20 then preferably records onto 
Ml 3 data storage device, (i) the encrypted value V, (ii) the encrypted authorization key, (iii) the 
CJ4 encrypted critical portion, and (iv) the unintelligible data portion of the database. 

vj5 When the navigation system receives data storage device 22 and seeks to access the 

Kl6 database, at block 368, the navigation system uses its public key to decrypt the encrypted value 

17 V. The navigation system may therefore retrieve values R and C from value V. At block 370, 

18 the navigation system then uses value R to symmetrically decrypt the encrypted authorization 

19 key. At block 372, the navigation system then computes the checksum or CRC of the 

20 authorization key and compares the resulting value with value C. If value C matches, then, at 

21 block 374, the navigation system proceeds to use the authorization parameters to validate use of 

22 the database as described above. Alternatively, if value C does not match, then, at block 376, the 

23 navigation system may refuse to access the geographic database. 
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1 In yet another exemplary embodiment, the process of securing geographic data can be 

2 still further enhanced. In this further embodiment, the authorization key can be encrypted in 

3 such as way that the decryption key required to access the authorization key is itself tied to 

4 environmental parameters, such as the authorization parameters and/or contents of the database. 

5 Figure 12 is a flow chart depicting an example of this further enhanced security process. 

6 As shown in Figure 12, at block 450, the authorization server generates a random value, 
■7 K, and uses the value K as a key to symmetrically encrypt the critical portion of the database, so 

' ;8 as to produce an encrypted critical portion that can be decrypted using the value K. 

9 At block 452, the authorization server then assembles a set of authorization parameters 

% and combines the parameters to establish an authorization key. These parameters may be the 

Hjl same as those described above, except that the parameters preferably exclude the navigation 

£§2 system ID and the storage device ID. The navigation system ID and storage device ID will 

§43 instead be used in the process of producing a symmetric key for encrypting the authorization key. 

Cf4 Further, the parameters preferably do not yet include the value K required for decryption of the 

S.5 encrypted critical portion of the database. Still further, the parameters may exclude the database 

3 6 version information and other such information (since, as will be noted below, other intrinsic 

17 information about the database (e.g., bytes of the database) may be incorporated in the securing 

18 process instead). 

19 At block 454, the authorization server calculates a checksum or CRC, C, of the 

20 authorization key. At block 456, the authorization server may then generate an ID value, N, 

21 which the authorization server may record in its data store 28 as a key to a database record 

22 indicative of environmental parameters such as the user, the navigation system and the storage 

23 device for instance. 
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1 Next, at block 458, the authorization server computes a one-way hash function or other 

2 function to generate an output value H. The hash function is preferably based on the 

3 authorization key. In particular, for instance, the inputs to the hash function are preferably 

4 values that should be accessible by both the machine generating the authorization key (i.e., 

5 authorization server 12) and the machine that will decrypt the authorization key (i.e., navigation 

6 system 16). In this exemplary embodiment, the inputs to the hash function include 

7 environmental parameters, such as (i) the navigation system ID, (ii) the storage device ID, (iii) 

8 the ID value N, (iv) the checksum or CRC value C, and (v) a predetermined number of bytes 

9 selected from a predetermined location of the encrypted critical portion of the database. Suitable 
4t 0 hash functions are well known to those skilled in the art, as described, for instance, in Schneier, 
Jill B„ "Applied Cryptography Protocols, Algorithms, and Source Code in C," Chapters 11-14, 
52 18-19 and 24 (2d ed., John Wiley & Sons, Inc. 1996). 

H3 At block 460, the authorization server may then XOR or otherwise combine the output 

CU value H with the random value K that was used to symmetrically encrypt the critical portion of 

3 5 the database, and the authorization server may thereby produce a value K\ At block 462, the 

%6 authorization server may then append or otherwise add the value K' to the authorization key. 

17 This way, a machine seeking to access the database will be forced to first establish the value H 

18 and then XOR the value H with the value K', so as to recover the value K for use in decrypting 

19 the encrypted critical portion. Therefore, the machine seeking access to the data will need to 

20 have access to the parameters that were used to establish the value H (such as navigation system 

21 ID and storage device ID, for instance) in order for the machine to effectively have access to the 

22 decryption key K, in order to facilitate decryption of the critical portion and, in turn, in order to 

23 facilitate access to the database. 
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1 At block 464, the authorization server preferably uses the value H as a symmetric key to 

2 encrypt the authorization key, so as to produce an encrypted authorization key that can be 

3 decrypted using the value PL Again, because the value H stems from certain environmental 

4 parameters such as the navigation system ID and storage device ID, for instance, a machine 

5 seeking access to the database will need to know these parameters in order to facilitate access to 

6 the database, thereby providing added security. 

7 At block 466, the authorization server may next combine together the ID value N with the 



8 checksum or CRC value C, such as by concatenating or interleaving the values for instance, to 

9 produce a value V. At block 468, the authorization server then uses the private key (associated 

10 with the navigation system model) to encrypt the value V. Finally, at block 470, the 

11 authorization server sends to terminal 20 (i) the encrypted value V, (ii) the encrypted 

12 authorization key, and (ii) the encrypted critical portion. 



13 Upon receipt of this information, at block 472, terminal 20 then preferably records onto 

14 data storage device, (i) the encrypted value V, (ii) the encrypted authorization key, (iii) the 

15 encrypted critical portion, and (iv) the unintelligible data portion of the database. 

16 When the navigation system receives data storage device 22 and seeks to access the 

17 database, at block 474, the navigation system uses its public key to decrypt the encrypted value 

18 V. The navigation system may therefore retrieve values N and C from value V. 

19 At block 476, the navigation system then computes the same hash function that the 

20 authorization server computed, with the same inputs used by the authorization server. In the 

21 exemplary embodiment, therefore, if navigation system does not have access to the 

22 environmental parameters, such as the navigation system ID and storage device ID, the 

23 navigation system will not be able to successfully compute the same value H that the 
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1 authorization server computed, and the navigation system may be precluded from accessing the 

2 database. Similarly, if the navigation system does not have the required public key and is 

3 therefore unable to decrypt encrypted value V at block 474, it will not be able to uncover values 

4 N and C and, consequently, it will not be able to compute the hash function. However, if the 

5 navigation system has access to, and uses, the appropriate inputs, the hash function will produce 

6 the value H. 

7 At block 478, the navigation system then uses the computed value H as a symmetric key 

8 to decrypt the encrypted authorization key. In turn, at block 480, the navigation system 

9 computes the checksum or CRC of the authorization key and compares that value to the value C 
that it retrieved from the value V. If value C does not match, then, at block 482, the navigation 

1 system may refuse to access the database. Alternatively, if value C matches, then the navigation 

£32 system continues to block 484. At block 484, the navigation system extracts from the 

H3 authorization key the value K f , and, at block 486, the navigation system XORs or otherwise 

y 4 combines K' with H so as to reveal the value K. 

J45 At block 488, the navigation system may use other parameters of the authorization key to 

H6 validate use of the database. Finally, assuming successful validation, at block 490, the 

17 navigation system may use the value K as a symmetric key to decrypt the encrypted critical 

18 portion of the database and may proceed to access and use the data portion of the database. 

19 In still a further exemplary embodiment, the process of securing geographic data can be 

20 additionally enhanced, still tying the authorization key to environmental parameters. In this 

21 further embodiment, the authorization server may first generate a random number K and may 

22 then use that random number K as a key to symmetrically encrypt the critical portion of the 

23 database. The authorization server may then compile a first portion A' of an authorization key, 
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1 including parameters such as a pointer to a randomly selected location of the database and a 

2 value at that location, starting and ending dates for data validity, maximum use count, and 

3 information about selected options. The authorization server may also include in the first portion 

4 A' one or more values computed as a one-way hash function of the critical portion of the 

5 database. 

6 The authorization server may then apply a one-way hash function, whose inputs may be 

7 the navigation system ID, the storage device ID, the first portion A' of the authorization key, 

8 some number of bytes from the encrypted critical portion, and/or other parameters that may be 

9 accessible by both the navigation system and the authorization server. The output of the hash 
3 0 function may be designated H. 

rfll l The authorization server may then XOR the output H with the random number K, so as to 

S 2 produce a value K\ In turn, the authorization server may store the value K' in a second portion 

H3 A" of the authorization key. The authorization server may then calculate a CRC or hash function 

^4 of A' and K' (or perhaps just a CRC or hash function of just A') and store the result in the second 

J~i5 portion A" as well 

S|6 Next, the authorization server may append or otherwise combine together A' and A" to 

17 produce an authorization key A, The authorization server may then encrypt the authorization 

18 key with the navigation system's private key (or public key). Finally, the authorization server 

19 may send to terminal 20 the symmetrically encrypted critical portion of the database and the 

20 encrypted authorization key. 

21 Upon receipt of this information, terminal 20 may record the information onto the data 

22 storage device 22, together with the unintelligible portion of the database. Thereafter, when the 

23 data storage device is coupled with the navigation system, the navigation system may use its 
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1 public key (or private key) to decrypt the encrypted authorization key, so as to recover the 

2 plaintext authorization key A. 

3 The navigation system may then compute the same CRC or hash function of A and K' 

4 that the authorization server computed and may compare the result with the value stored in the 

5 second portion A" of the authorization key. If the values do not match, then the navigation 

6 system may be programmed to abort its efforts to access the data. 

7 The navigation system may next check to ensure that the current date is between the 

8 starting and ending dates provided in the first portion A' of the authorization key. If the current 

9 date does not fall within the allowed date range, then the navigation system may also be 
~30 programmed to abort. 

The navigation system may then compute the same hash function that the authorization 

ffll2 server computed, with the same inputs used by the authorization server, so as to produce the 

H3 output H. In turn, the navigation system may XOR the value H with the value K' that is stored in 

^4 the second portion A" of the authorization key, so as to recover the value K. Thereafter, the 

^45 navigation system may use the value K as a key to symmetrically decrypt the encrypted critical 

rt 6 portion of the database and may then proceed to access and use the data portion of the database. 

17 In this exemplary embodiment, the navigation system would therefore need to have 

18 access to environmental parameters such as the navigation system ID and storage device ID as 

19 used in the hash function computed by the authorization server. Absent access to such 

20 information, the navigation system would be prevented from computing the value H, which 

21 would prevent the navigation system from uncovering the value K needed to symmetrically 

22 decrypt the critical portion of the database. 
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1 Further, in an arrangement where the authorization server included in first portion A ! one 

2 or more hash values of the critical portion of the database, the navigation system may be 

3 programmed to verify those hash values by computing the same hash function as applied by the 

4 authorization server and comparing the resulting values. 

5 D. Exemplary Advantages 

6 The system and method described by way of example in this specification can 

7 advantageously help avoid many of the security risks associated with providing valuable data, 

8 such as geographic data. For instance, in various embodiments, the system and method can help 

9 foil attempts at fraud in the following manners: 

yjo L If someone tries to copy the data to another storage device, the machine seeking 

Si to access the data may determine that the storage device is not authorized to hold 

fQ2 the data and may therefore refuse to access the data. 

Ht3 2. If someone tries to access the data using a machine other than the authorized 

Sj4 machine, the machine may determine that it is not authorized to access the data 

JIi5 and may therefore refuse to access the data. 

qi6 3. If someone tries to use the authorization key to access data other than the data for 

17 which the authorization key was generated, access may be precluded. 

18 4. If someone tries to use an expired set of data (such as a database for which a 

19 rental period or number of uses has expired), access may be precluded. 

20 5. If someone tries to access the data using a machine that is not programmed to 

21 perform validation, access may be precluded. 

22 In addition, the exemplary embodiments provide additional security features. For 

23 example, a random encryption key is used for each instance of a database, thereby helping to 
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1 prevent certain types of ciyptanalysis. As another example, by tying authorization to database 

2 access libraries (e.g., the critical portion of a database), authorization becomes required in order 

3 to access the database. Therefore, navigation system vendor may have to include authorization 

4 functions in their systems. 

5 E. Alternative Embodiment 

6 In an alternative embodiment of the present invention, some or all of the geographic data 

7 or authorization information can be provided more directly from the authorization server to the 

8 navigation system. Figure 13 is a simplified block diagram illustrating this alternative 

9 embodiment by way of example. 

IllO In this alternative embodiment, as shown in Figure 13, a communications link 14 couples 

y!ll the authorization server 12 to a representative navigation system 16. Link 14 may take any form 

Hi 12 suitable for carrying communications between authorization server 12 and navigation system 16. 

^13 For instance, link 14 may include or take the form of a satellite or cellular communications 

„^ 14 system or other wireless interface and/or the public switched telephone network or other landline 

15 interface. As such, link 14 may include various intermediate elements as well (not shown in 

C 16 Figure 13). 

17 In this embodiment, the data interface units 32, 70 of authorization server 12 and 

18 navigation system 16 then take a form suitable for communicating with link 14. Alternatively, 

19 authorization server 12 and/or navigation system 16 each include an additional data interface unit 

20 suitable for communicating with link 14. For instance, if link 14 is a cellular 

21 telecommunications network, then navigation system 16 preferably includes the components that 

22 would ordinarily be found within a cellular telephone or other mobile station (such as an 
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1 appropriate RF transceiver and the program logic necessary to originate and terminate calls, for 

2 example). 

3 In this embodiment, authorization server 12 can itself convey the entire secured 

4 geographic database to navigation system 16 via link 14. In particular, authorization server 12 

5 preferably prepares and provides to navigation system 16 (i) the authorization material (e.g., 

6 encrypted critical portion and authorization parameters, etc.) described above as being provided 

7 by authorization server 12 to data distribution terminal 20 and (ii) the data portion 62 of a 

8 geographic database to be used by the navigation system 16. The authorization server may 

9 provide this material to the navigation system on request or in response to another specified 
y 0 stimulus. Further, in the event the navigation system already has the data portion 62 of a given 
?4 1 database, the authorization server may conveniently send only the authorization material to the 
012 navigation system. The navigation system 16 may then employ a process equivalent to that 
H3 described above, to decrypt, validate and use the database. 

C|4 As shown in Figure 13, communications link 18, data terminal 20, and portable data 

Q5 storage device 22 may also still be employed to carry information from authorization server 12 to 

51 6 navigation system 16 in this alternative embodiment. In this arrangement, for instance, some 

17 information may be conveyed via link 14 to the navigation system 16, and other information may 

18 be conveyed via link 18 to data terminal 20 and then via portable storage device 22 to navigation 

19 system 16. 

20 As a particular example, a user may load the data portion 62 of a database onto storage 

21 device 22 at terminal 20, for instance, and then couple the storage device with a navigation 

22 system 16. In providing the user with the data portion 62, terminal 20 may communicate with 

23 authorization server 12 to an extent as provided above, and authorization server 12 may establish 
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1 the necessary authorization material (e.g., encrypted critical portion and authorization 

2 parameters, etc.) Unlike the above scenario, however, authorization server 12 might not send the 

3 authorization material to terminal 20. When navigation system 16 then detects the presence of 

4 the storage device 22, it may be programmed to responsively contact authorization server 12 via 

5 link 14 (e.g., by placing a cellular telephone call to the authorization server) and to request the 

6 authorization material. Authorization server 12 may then send the authorization material, and 

7 navigation system 16 may use the authorization material to facilitate access to the database. 

, 8 As still another variation of this alternative embodiment, link 14 may itself comprise 

' 9 portable data storage device 22, which may be physically transported from authorization server 

9o 12 (or another entity) to navigation system 16. In this arrangement, for instance, authorization 

ll l server 12 may record onto storage device 22 all of the information that terminal 20 would have 

§12 recorded onto the storage device in the embodiments described above and then provide the 

H3 storage device for use in navigation system 16. 

% 4 In this variation, for instance, a user may order a particular set of geographic data from a 

[Jl5 data provider, such as via the Internet or via a call center. The data provider may obtain the user 

Si6 ID, navigation system ID and other information (such as the information that terminal 20 would 

17 obtain in the embodiments described above) and then employ the authorization server to generate 

18 and record onto a storage device 22 the requested data set. The data provider may then ship or 

19 otherwise transport the loaded storage device 22 to the user for use by the navigation system as 

20 described above. 

21 F. Conclusion 

22 Examples of the present invention have been described above. Those skilled in the art will 

23 understand, however, that changes and modifications may be made in these embodiments without 
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1 departing from the true scope and spirit of the present invention, which is defined by the following 

2 claims. 

3 For example, where the above description notes that certain logic functions may be 

4 carried out by a processor executing software instructions, those functions can equally be 

5 employed through hardware, firmware, or a combination of hardware, firmware and software if 

6 desired. 

7 As another example, while the foregoing description has focused on securing geographic 

8 data and providing geographic data for use by a navigation system, the elements, systems and 

9 processes described can be equally employed to secure and communicate other types of data for 

10 use in other contexts. Examples of such other data include those described in the background 

11 section (e.g., data for music players or video players (such as songs or movies), data for video 

12 game consoles (such as games, etc.), as well as other sorts of data now known or later developed. 
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CLAIMS 

I claim: 

1 1 . A method for on-line mass distribution of data products to end users, the method 

2 comprising: 

3 maintaining a first portion of each of said data products at a first location; 

4 maintaining a second portion of each of said data products at a second location; 

5 for each of said end users, confirming the end user's entitlement to one of said data 

6 products; 

7 obtaining a first portion of said one of said data products from said first location and a 
second portion of said one of said data products from said second location; 

frJ combining said first portion of said one of said data products and said second portion of 

ICS said one of said data products; and 

lS^ providing said combined first portion and second portion to said user. 

m 

Jl i 2. The method of claim 1 , wherein said data products include geographic databases. 

S 2 

1 3. The method of claim 1, wherein said data products include digital copies of 

2 movies. 

3 

1 4. The method of claim 1, wherein said data products include digital copies of 

2 musical songs. 

3 



-51 - 



N0064US 



1 5 . The method of claim 1 , further comprising the step of: 

2 encrypting said first portion of each of said data products. 

3 

1 6. The method of claim 1 , further comprising the step of: 

2 prior to the step of combining, encrypting said first portion of one of said data products. 

3 

1 7. The method of claim 1, wherein said step of combining is performed at said 

2 second location. 
3 

^1 8. A system for secure on-line mass distribution of data products to end users 

g|2 comprising: 

ffl3 an authorization server having associated therewith copies of first portions of a plurality 

NM of data products; 

CJ 5 a plurality of data distribution terminals, each of which has associated therewith copies of 

^ 6 second portions of said plurality of data products; 

p s 7 a communications system that provides for exchange of data between said authorization 

8 server and said plurality of data distribution terminals, and 

9 a data distribution program that provides copies of said data products to those end users 

10 who are entitled to have said copies thereof, wherein said data distribution program provides a 

11 copy of a data product by combining a copy of the first portion of said data product obtained 

12 from said authorization server with a copy of the second portion of said data product obtained 

13 from one of said plurality of data distribution terminals. 



14 
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1 9. The system of claim 8, wherein said authorization server also has associated 

2 therewith an authorization database containing data indicating entitlement by said end users to 

3 copies of said data products. 
4 

1 10. A system for securely conveying a data product, the data product defining a first 

2 portion and a second portion, the first portion defining at least one key to the second portion, the 

3 system comprising, in combination: 

4 a first entity maintaining the first portion; 

5 a second entity maintaining the second portion; 

y 6 a first set of logic executable by the first entity to encrypt the first portion so as to 

m 7 produce an encrypted first portion that can be decrypted using a first decryption key, wherein the 

CO 8 first entity sends the encrypted first portion via a telecommunications link to the second entity; 

S^9 and 

%o a second set of logic executable by the second entity, upon receipt of the encrypted first 

1 portion, to record onto a storage medium the encrypted first portion and the second portion, 

rt2 wherein the storage medium may be provided to a third entity, which, if provided with 

13 access to the first decryption key, can in turn access the data product. 
14 

1 11. The system of claim 10, wherein the first entity sends to the second entity, 

2 together with the encrypted first portion, an encrypted authorization key that can be decrypted 

3 using a second decryption key so as to reveal verification information indicative of an entity 

4 authorized to access the data product, and wherein the second set of logic is further executable to 

5 record onto the storage medium the encrypted authorization key. 
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1 12. The system of claim 11, wherein the second decryption key is derived as a 

2 function of an environmental parameter. 

3 

1 13. The system of claim 12, wherein the environmental parameter comprises an 

2 identification code associated with the entity authorized to access the data product. 

3 

1 14. The system of claim 11, wherein the third entity has access to the second 

2 decryption key, the system further comprising: 

3 a third set of logic executable by the third entity to decrypt the encrypted authorization 



% key, to thereby gain access to the verification information, and to use the verification information 
to validate use of the data product. 

ro6 

Ml 15. The system of claim 11, wherein the third entity has access to the second 

O2 decryption key, the system further comprising: 

JT3 a third set of logic executable by the third entity to decrypt the encrypted authorization 

J5j4 information, to thereby gain access to the verification information, and to compare at least a 

5 portion of the verification information to predetermined information associated with the third 

6 entity so as to determine whether the third entity is authorized to access the data product. 

7 

1 16. The system of claim 15, wherein the predetermined information associated with 

2 the third entity comprises an identification code. 

3 
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1 17. The system of claim 10, wherein the first entity sends to the second entity, 

2 together with the encrypted first portion, an encrypted authorization key that can be decrypted 

3 using a second decryption key so as to reveal verification information indicative of an entity 

4 authorized to store the data product. 
5 

1 18. The system of claim 17, wherein the second decryption key is derived as a 

2 function of an environmental parameter. 

3 

1 19. The system of claim 18, wherein the environmental parameter comprises an 

2 identification code associated with the entity authorized to store the data product. 

3 

1 20. The system of claim 17, wherein the third entity has access to the second 

2 decryption key, the system further comprising: 

3 a third set of logic executable by the third entity to decrypt the encrypted authorization 

4 key, to thereby gain access to the verification information, and to use the verification information 

5 to validate storage of the data product. 



6 

1 21. The system of claim 17, wherein the third entity has access to the second 

2 decryption key, the system further comprising: 

3 a third set of logic executable by the third entity to decrypt the encrypted authorization 

4 information, to thereby gain access to the verification information, and to compare at least a 

5 portion of the verification information to predetermined information associated with the storage 

6 medium so as to determine whether the storage medium is authorized to store the data product. 
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1 22. The system of claim 21, wherein the predetermined information associated with 

2 the storage medium comprises an identification code. 

3 

1 23. The system of claim 10, wherein the data product comprises geographic 

2 information and the third entity comprises a navigation system. 

3 

1 24. A method for securely conveying a data product, the data product defining a first 

2 portion and a second portion, the first portion defining at least one key to the second portion, the 

3 method comprising, in combination: 

^4 at a first entity, encrypting the first portion of the data product so as to produce an 

m5 encrypted first portion that can be decrypted using a first decryption key; 

C36 sending the encrypted first portion via a telecommunications link from the first entity to a 

H=7 second entity; 

y 8 receiving the encrypted first portion at the second entity; 

17 9 at the second entity, recording onto a storage medium the encrypted first portion and the 

rio second portion; and 

1 1 thereafter providing the storage medium to a third entity, 

12 whereby, if the third entity has access to the first decryption key, the third entity may 

13 decrypt the encrypted first portion and thereby gain access to the data product. 
14 

1 25. The method of claim 24, further comprising sending to the second entity, together 

2 with the encrypted first portion, an encrypted authorization key that can be decrypted using a 
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3 second decryption key so as to reveal verification information indicative of an entity authorized 

4 to access the data product. 
5 

1 26. The method of claim 25, further comprising generating the second decryption key 

2 as a function of an environmental parameter. 

3 

1 27. The method of claim 26, wherein the environmental parameter comprises an 

2 identification code associated with the entity authorized to access the data product. 

3 

1 28. The method of claim 27, further comprising: 

2 the third entity generating the second decryption key as the function of the identification 

3 code; 

4 the third entity using the second decryption key to decrypt the encrypted authorization 

5 key and to thereby gain access to the verification information; and 

6 the third entity using the verification information to validate storage of the data product. 

7 

1 29. The method of claim 25, further comprising; 

2 the third entity using the second decryption key to decrypt the encrypted authorization 

3 key and to thereby gain access to the verification information; and 

4 the third entity using the verification information to validate use of the data product. 

5 
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1 30. The method of claim 29, wherein using the verification information to validate 

2 use of the data product comprises comparing at least a portion of the verification information to 

3 predetermined information associated with the third entity so as to determine whether the third 

4 entity is authorized to access the data product. 

5 

1 31. The method of claim 30, wherein the predetermined information associated with 

2 the third entity comprises an identification code. 
3 

1 32. The method of claim 24, further comprising sending to the second entity, together 

2 with the encrypted first portion, an encrypted authorization key that can be decrypted using a 

3 second decryption key so as to reveal verification information indicative of an entity authorized 

4 to store the data product. 

5 

1 33. The method of claim 32, further comprising generating the second decryption key 

2 as a function of an environmental parameter. 

3 

1 34. The method of claim 33, wherein the environmental parameter comprises an 

2 identification code associated with the entity authorized to store the data product. 

3 
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1 35. The method of claim 34, further comprising: 

2 the third entity generating the second decryption key as the function of the identification 

3 code; 

4 the third entity using the second decryption key to decrypt the encrypted authorization 

5 key and to thereby gain access to the verification information; and 

6 the third entity using the verification information to validate storage of the data product. 
7 

1 36. The method of claim 32, further comprising: 

2 the third entity using the second decryption key to decrypt the encrypted authorization 

3 key and to thereby gain access to the verification information; and 

|| 4 the third entity using the verification information to validate storage of the data product. 

H i 37. The method of claim 36, wherein using the verification information to validate 

3 2 storage of the data product comprises comparing at least a portion of the verification information 

S 3 to predetermined information associated with the storage medium so as to determine whether the 

§3 4 storage medium is authorized to store the data product. 



5 



1 38. The method of claim 37, wherein the predetermined information associated with 

2 the storage medium comprises an identification code. 

3 

1 39. The method of claim 24, wherein the data product comprises geographic 

2 information and the third entity comprises a navigation system. 
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1 ABSTRACT 

2 A system and method for mass distribution of data products, such as geographic 

3 databases. An authorization server maintains a first portion of each of several data products, and 

4 each of several data distribution terminals maintains the second portion of each data product. A 

5 user may couple a portable data storage device with a data distribution terminal and select a 

6 desired data product. The terminal may then responsively obtain from the authorization server 

7 the first portion of the selected data product and record onto the data storage device both the first 

8 portion and second portion of the data product. The user may then couple the data storage device 

9 with a machine, such as a navigation system, which may then access the data product. The 
J^O authorization server may secure the first portion before sending it to the data distribution 
01 terminal The authorization server may do so by encrypting the first portion and tying the first 
ffil 2 portion together with an authorization key. The machine may then use the authorization key to 
H3 validate and/or facilitate access to the first portion and in turn to the data product as a whole. 
¥l4 
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